// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *   Copyright (C) 2016 Namjae Jeon <namjae.jeon@protocolfreedom.org>
 *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
 */

#include <linux/mutex.h>
#include <linux/freezer.h>
#include <linux/module.h>

#include "server.h"
#include "smb_common.h"
#ifdef CONFIG_SMB_INSECURE_SERVER
#include "smb1pdu.h"
#endif
#include "mgmt/ksmbd_ida.h"
#include "connection.h"
#include "transport_tcp.h"
#include "mgmt/user_session.h"
#include "transport_rdma.h"

static DEFINE_MUTEX(init_lock);

enum LocalSpeedDir {
	SPEED_DIR_INVALID = 0,
	SPEED_DIR_UP,
	SPEED_DIR_DOWN,
	SPEED_DIR_BOTH
};

struct tr143_pkt_ctrl {
	unsigned int mode;
	unsigned int sip;
	unsigned int dip;
	unsigned int proto;
	unsigned short sport;
	unsigned short dport;
	unsigned int owner;
	enum LocalSpeedDir speed_dir;
	unsigned int stack;
	struct in6_addr sipv6;
	struct in6_addr dipv6;
};

typedef unsigned int (*func_ffwd_tuple_accelerate)(struct tr143_pkt_ctrl *info, bool proc);

static struct ksmbd_conn_ops default_conn_ops;

static int g_total_request_cnt;

LIST_HEAD(conn_list);
DECLARE_RWSEM(conn_list_lock);

int ksmbd_get_current_task_cnt(void)
{
	return g_total_request_cnt;
}

/**
 * ksmbd_conn_free() - free resources of the connection instance
 *
 * @conn:	connection instance to be cleand up
 *
 * During the thread termination, the corresponding conn instance
 * resources(sock/memory) are released and finally the conn object is freed.
 */
void ksmbd_conn_free(struct ksmbd_conn *conn)
{
	down_write(&conn_list_lock);
	list_del(&conn->conns_list);
	up_write(&conn_list_lock);

	xa_destroy(&conn->sessions);
	kvfree(conn->request_buf);
	kfree(conn->preauth_info);
	if (atomic_dec_and_test(&conn->refcnt))
		kfree(conn);
}

/**
 * ksmbd_conn_alloc() - initialize a new connection instance
 *
 * Return:	ksmbd_conn struct on success, otherwise NULL
 */
struct ksmbd_conn *ksmbd_conn_alloc(void)
{
	struct ksmbd_conn *conn;

	conn = kzalloc(sizeof(struct ksmbd_conn), GFP_KERNEL);
	if (!conn)
		return NULL;

	conn->need_neg = true;
	ksmbd_conn_set_new(conn);
	conn->local_nls = load_nls("utf8");
	if (!conn->local_nls)
		conn->local_nls = load_nls_default();
	if (IS_ENABLED(CONFIG_UNICODE))
		conn->um = utf8_load("12.1.0");
	else
		conn->um = ERR_PTR(-EOPNOTSUPP);
	if (IS_ERR(conn->um))
		conn->um = NULL;
	atomic_set(&conn->req_running, 0);
	atomic_set(&conn->r_count, 0);
	atomic_set(&conn->refcnt, 1);
	conn->total_credits = 1;
	conn->outstanding_credits = 0;

	init_waitqueue_head(&conn->req_running_q);
	init_waitqueue_head(&conn->r_count_q);
	INIT_LIST_HEAD(&conn->conns_list);
	INIT_LIST_HEAD(&conn->requests);
	INIT_LIST_HEAD(&conn->async_requests);
	spin_lock_init(&conn->request_lock);
	spin_lock_init(&conn->credits_lock);
	ida_init(&conn->async_ida);
	xa_init(&conn->sessions);

	spin_lock_init(&conn->llist_lock);
	INIT_LIST_HEAD(&conn->lock_list);

	down_write(&conn_list_lock);
	list_add(&conn->conns_list, &conn_list);
	up_write(&conn_list_lock);
	return conn;
}

bool ksmbd_conn_lookup_dialect(struct ksmbd_conn *c)
{
	struct ksmbd_conn *t;
	bool ret = false;

	down_read(&conn_list_lock);
	list_for_each_entry(t, &conn_list, conns_list) {
		if (memcmp(t->ClientGUID, c->ClientGUID, SMB2_CLIENT_GUID_SIZE))
			continue;

		ret = true;
		break;
	}
	up_read(&conn_list_lock);
	return ret;
}

void ksmbd_conn_enqueue_request(struct ksmbd_work *work)
{
	struct ksmbd_conn *conn = work->conn;
	struct list_head *requests_queue = NULL;
#ifdef CONFIG_SMB_INSECURE_SERVER
	struct smb2_hdr *hdr = work->request_buf;

	if (hdr->ProtocolId == SMB2_PROTO_NUMBER) {
		if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE)
			requests_queue = &conn->requests;
	} else {
		if (conn->ops->get_cmd_val(work) != SMB_COM_NT_CANCEL)
			requests_queue = &conn->requests;
	}
#else
	if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE)
		requests_queue = &conn->requests;
#endif

	if (requests_queue) {
		atomic_inc(&conn->req_running);
		spin_lock(&conn->request_lock);
		list_add_tail(&work->request_entry, requests_queue);
		spin_unlock(&conn->request_lock);
	}
}

int ksmbd_conn_try_dequeue_request(struct ksmbd_work *work)
{
	struct ksmbd_conn *conn = work->conn;
	int ret = 1;

	if (list_empty(&work->request_entry) &&
	    list_empty(&work->async_request_entry))
		return 0;

	if (!work->multiRsp)
		atomic_dec(&conn->req_running);
	if (!work->multiRsp) {
		spin_lock(&conn->request_lock);
		list_del_init(&work->request_entry);
		spin_unlock(&conn->request_lock);
		if (work->asynchronous)
			release_async_work(work);
		ret = 0;
	}

	wake_up_all(&conn->req_running_q);
	return ret;
}

void ksmbd_conn_lock(struct ksmbd_conn *conn)
{
	mutex_lock(&conn->srv_mutex);
}

void ksmbd_conn_unlock(struct ksmbd_conn *conn)
{
	mutex_unlock(&conn->srv_mutex);
}

void ksmbd_all_conn_set_status(u64 sess_id, u32 status)
{
	struct ksmbd_conn *conn;

	down_read(&conn_list_lock);
	list_for_each_entry(conn, &conn_list, conns_list) {
		if (conn->binding || xa_load(&conn->sessions, sess_id))
			WRITE_ONCE(conn->status, status);
	}
	up_read(&conn_list_lock);
}

void ksmbd_conn_wait_idle(struct ksmbd_conn *conn, u64 sess_id)
{
	struct ksmbd_conn *bind_conn;

	wait_event(conn->req_running_q, atomic_read(&conn->req_running) < 2);

	down_read(&conn_list_lock);
	list_for_each_entry(bind_conn, &conn_list, conns_list) {
		if (bind_conn == conn)
			continue;

		if ((bind_conn->binding || xa_load(&bind_conn->sessions, sess_id)) &&
		    !ksmbd_conn_releasing(bind_conn) &&
		    atomic_read(&bind_conn->req_running)) {
			wait_event(bind_conn->req_running_q,
				atomic_read(&bind_conn->req_running) == 0);
		}
	}
	up_read(&conn_list_lock);
}

int ksmbd_conn_write(struct ksmbd_work *work)
{
	struct ksmbd_conn *conn = work->conn;
	size_t len = 0;
	int sent;
	struct kvec iov[3];
	int iov_idx = 0;

	if (!work->response_buf) {
		pr_err("NULL response header\n");
		return -EINVAL;
	}

	if (work->tr_buf) {
		iov[iov_idx] = (struct kvec) { work->tr_buf,
				sizeof(struct smb2_transform_hdr) + 4 };
		len += iov[iov_idx++].iov_len;
	}

	if (work->filp) {
		return 0;
	} else if (work->aux_payload_sz) {
		iov[iov_idx] = (struct kvec) { work->response_buf, work->resp_hdr_sz };
		len += iov[iov_idx++].iov_len;
		iov[iov_idx] = (struct kvec) { work->aux_payload_buf, work->aux_payload_sz };
		len += iov[iov_idx++].iov_len;
	} else {
		if (work->tr_buf)
			iov[iov_idx].iov_len = work->resp_hdr_sz;
		else
			iov[iov_idx].iov_len = get_rfc1002_len(work->response_buf) + 4;
		iov[iov_idx].iov_base = work->response_buf;
		len += iov[iov_idx++].iov_len;
	}

	ksmbd_conn_lock(conn);
	sent = conn->transport->ops->writev(conn->transport, &iov[0],
					iov_idx, len,
					work->need_invalidate_rkey,
					work->remote_key);
	ksmbd_conn_unlock(conn);

	if (sent < 0) {
		pr_err("Failed to send message: %d\n", sent);
		return sent;
	}

	return 0;
}

int ksmbd_conn_rdma_read(struct ksmbd_conn *conn,
			 void *buf, unsigned int buflen,
			 struct smb2_buffer_desc_v1 *desc,
			 unsigned int desc_len)
{
	int ret = -EINVAL;

	if (conn->transport->ops->rdma_read)
		ret = conn->transport->ops->rdma_read(conn->transport,
						      buf, buflen,
						      desc, desc_len);
	return ret;
}

int ksmbd_conn_rdma_write(struct ksmbd_conn *conn,
			  void *buf, unsigned int buflen,
			  struct smb2_buffer_desc_v1 *desc,
			  unsigned int desc_len)
{
	int ret = -EINVAL;

	if (conn->transport->ops->rdma_write)
		ret = conn->transport->ops->rdma_write(conn->transport,
						       buf, buflen,
						       desc, desc_len);
	return ret;
}

bool ksmbd_conn_alive(struct ksmbd_conn *conn)
{
	if (!ksmbd_server_running())
		return false;

	if (ksmbd_conn_exiting(conn))
		return false;

	if (kthread_should_stop())
		return false;

	if (atomic_read(&conn->stats.open_files_count) > 0)
		return true;

	/*
	 * Stop current session if the time that get last request from client
	 * is bigger than deadtime user configured and opening file count is
	 * zero.
	 */
	if (server_conf.deadtime > 0 &&
	    time_after(jiffies, conn->last_active + server_conf.deadtime)) {
		ksmbd_debug(CONN, "No response from client in %lu minutes\n",
			    server_conf.deadtime / SMB_ECHO_INTERVAL);
		return false;
	}
	return true;
}

static void ffwd_tuple_accelerate(bool proc, struct sockaddr *sock_addr, struct sockaddr *local_addr)
{
	int ret;
	unsigned int dip = 0;
	unsigned int sip = 0;
	char ipv4_addr[9] = {0};
	char ipv4_addr_peer[9] = {0};
	char sub_addr[25] = {0};
	struct sockaddr_in *sock_in;
	struct sockaddr_in *sock_in_local;
	struct sockaddr_in6 *sock_in6;
	struct sockaddr_in6 *sock_in6_local;
	struct tr143_pkt_ctrl samba_ctrl;
	func_ffwd_tuple_accelerate accelerate;

	if ((sock_addr == NULL) || (local_addr == NULL)) {
		pr_err("Input error with null pointer\n");
		return;
	}

	memset(&samba_ctrl, 0, sizeof(struct tr143_pkt_ctrl));
	accelerate = (func_ffwd_tuple_accelerate)__symbol_get("ffwd_do_local_tuple_accelerate");
	if (accelerate == NULL) {
		pr_err("Symbol not found\n");
		return;
	}

	samba_ctrl.owner = 2;
	samba_ctrl.proto = IPPROTO_TCP;
	samba_ctrl.speed_dir = SPEED_DIR_BOTH;

	switch (sock_addr->sa_family) {
	case AF_INET:
		ksmbd_debug(CONN, "IPv4 request received\n");
		sock_in = (struct sockaddr_in *)sock_addr;
		sock_in_local = (struct sockaddr_in *)local_addr;

		samba_ctrl.sip = (unsigned int)sock_in->sin_addr.s_addr;
		samba_ctrl.dip = (unsigned int)sock_in_local->sin_addr.s_addr;
		samba_ctrl.sport = sock_in->sin_port;
		samba_ctrl.dport = sock_in_local->sin_port;
		samba_ctrl.stack = 0;

		break;
	case AF_INET6:
		ksmbd_debug(CONN, "IPv6 request received\n");
		sock_in6 = (struct sockaddr_in6 *)sock_addr;
		sock_in6_local = (struct sockaddr_in6 *)local_addr;

		samba_ctrl.sport = sock_in6->sin6_port;
		samba_ctrl.dport = sock_in6_local->sin6_port;

		(void)sprintf(sub_addr, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
			sock_in6_local->sin6_addr.s6_addr[0], sock_in6_local->sin6_addr.s6_addr[1],
			sock_in6_local->sin6_addr.s6_addr[2], sock_in6_local->sin6_addr.s6_addr[3],
			sock_in6_local->sin6_addr.s6_addr[4], sock_in6_local->sin6_addr.s6_addr[5],
			sock_in6_local->sin6_addr.s6_addr[6], sock_in6_local->sin6_addr.s6_addr[7],
			sock_in6_local->sin6_addr.s6_addr[8], sock_in6_local->sin6_addr.s6_addr[9],
			sock_in6_local->sin6_addr.s6_addr[10], sock_in6_local->sin6_addr.s6_addr[11]);
		if (strcmp(sub_addr, "00000000000000000000ffff") == 0) {
			ksmbd_debug(CONN, "IPv6 format compatible with IPv4\n");
			samba_ctrl.stack = 0;
			(void)sprintf(ipv4_addr, "%02x%02x%02x%02x", sock_in6_local->sin6_addr.s6_addr[12],
				sock_in6_local->sin6_addr.s6_addr[13], sock_in6_local->sin6_addr.s6_addr[14],
				sock_in6_local->sin6_addr.s6_addr[15]);
			ret = kstrtouint(ipv4_addr, 16, &dip);
			if (ret != 0) {
				pr_err("Data conversion failed\n");
				return;
			}

			samba_ctrl.dip = htonl(dip);
			(void)sprintf(ipv4_addr_peer, "%02x%02x%02x%02x", sock_in6->sin6_addr.s6_addr[12],
				sock_in6->sin6_addr.s6_addr[13], sock_in6->sin6_addr.s6_addr[14], sock_in6->sin6_addr.s6_addr[15]);
			ret = kstrtouint(ipv4_addr_peer, 16, &sip);
			if (ret != 0) {
				pr_err("Data conversion failed\n");
				return;
			}

			samba_ctrl.sip = htonl(sip);
		} else {
			ksmbd_debug(CONN, "Native IPv6 format\n");
			samba_ctrl.stack = 1;
			samba_ctrl.sipv6 = sock_in6->sin6_addr;
			samba_ctrl.dipv6 = sock_in6_local->sin6_addr;
		}
		break;
	default:
		break;
	}

	ksmbd_debug(CONN, "sport:[%u] dport:[%u] proc: [%d]\n", ntohs(samba_ctrl.sport),
				ntohs(samba_ctrl.dport), (int)proc);
	ret = accelerate(&samba_ctrl, proc);
	if (ret != 0)
		pr_err("Failed to process the ffwd request. ErrorCode:[%u] Proc:[%d]\n", ret, proc);
}

#define K(x) ((x) << (PAGE_SHIFT - 10))

static uint32_t ksmbd_get_sleep_time(void)
{
	struct sysinfo info;
	long available = si_mem_available();

	si_meminfo(&info);
	if ((K(info.freeram) < 7680) || (K(available) < 23552)) {
		ksmbd_debug(CONN, "ksmbd sleep time 20 ms\n");
		return 20;
	}

	return 0;
}

static int ksmbd_get_conn_busy_cnt(void)
{
	struct ksmbd_conn *t;
	int cnt = 0;
	int tmp = 0;

	down_read(&conn_list_lock);
	list_for_each_entry(t, &conn_list, conns_list) {
		tmp = atomic_read(&t->r_count);
		if (tmp >= 0)
			cnt += tmp;
	}
	up_read(&conn_list_lock);

	return cnt;
}

#define SMB1_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb_hdr))
#define SMB2_MIN_SUPPORTED_HEADER_SIZE (sizeof(struct smb2_hdr) + 4)

/**
 * ksmbd_conn_handler_loop() - session thread to listen on new smb requests
 * @p:		connection instance
 *
 * One thread each per connection
 *
 * Return:	0 on success
 */
int ksmbd_conn_handler_loop(void *p)
{
	struct ksmbd_session *sess = NULL;
	struct smb2_hdr *rcv_hdr2 = NULL;
	struct smb2_write_req *req = NULL;
	struct pipe_inode_info *ipipe = NULL;
	struct ksmbd_conn *conn = (struct ksmbd_conn *)p;
	struct ksmbd_transport *t = conn->transport;
	unsigned int pdu_size, max_allowed_pdu_size;
	struct file *files[2];
	char hdr_buf[4] = {0,};
	char smb2_hdr_buf[112] = {0}; /* 64+48 contains smba protocol head write request head */
	int size;

	struct sockaddr_in dest_in = {0};
	struct sockaddr_in source_in = {0};
	struct sockaddr_in6 dest_in6 = {0};
	struct sockaddr_in6 source_in6 = {0};
	struct socket *sock;
	struct sockaddr *peer_addr;
	struct sockaddr *local_addr;

	struct sysinfo info;
	int max_worker_cnt = 25;

	bool pipe_flag = (ksmbd_create_pipe_files == NULL) || (ksmbd_pipe_fcntl == NULL) ||
					(ksmbd_get_pipe_info == NULL);
	uint32_t time = 0;

	uint32_t max_write_size;
	uint32_t max_pdu_size = offsetof(struct smb2_write_req, Buffer);
	int error;

	max_write_size = ksmbd_get_max_write_size();
	max_pdu_size += max_write_size;

	si_meminfo(&info);
	if (K(info.totalram) < 235520)
		max_worker_cnt = 25;

	sock = TCP_TRANS(t)->sock;
	if (((struct sockaddr *)&(conn->peer_addr))->sa_family == AF_INET) {
		ksmbd_debug(CONN, "IPv4\n");
		peer_addr = (struct sockaddr *)&dest_in;
		local_addr = (struct sockaddr *)&source_in;
	} else {
		ksmbd_debug(CONN, "IPv6\n");
		peer_addr = (struct sockaddr *)&dest_in6;
		local_addr = (struct sockaddr *)&source_in6;
	}

	if (kernel_getpeername(sock, peer_addr) < 0)
		pr_err("getpeername failed\n");

	if (kernel_getsockname(sock, local_addr) < 0)
		pr_err("getsockname failed\n");

	mutex_init(&conn->srv_mutex);
	__module_get(THIS_MODULE);

	if (t->ops->prepare && t->ops->prepare(t))
		goto out;

	conn->last_active = jiffies;

	ffwd_tuple_accelerate(1, local_addr, peer_addr);
	while (ksmbd_conn_alive(conn)) {
		if (try_to_freeze())
			continue;

		kvfree(conn->request_buf);
		conn->request_buf = NULL;

		size = t->ops->read(t, hdr_buf, sizeof(hdr_buf), 8);
		if (size != sizeof(hdr_buf)) {
			pr_info("read hdr_buf failed, size: %d\n", size);
			break;
		}

		pdu_size = get_rfc1002_len(hdr_buf);
		ksmbd_debug(CONN, "RFC1002 header %u bytes, max_write_size %u bytes, max_pdu_size %u bytes\n",
					pdu_size, max_write_size, max_pdu_size);

		if (ksmbd_conn_good(conn))
			max_allowed_pdu_size =
				SMB3_MAX_MSGSIZE + conn->vals->max_write_size;
		else
			max_allowed_pdu_size = SMB3_MAX_MSGSIZE;

		if (pdu_size > max_allowed_pdu_size) {
			pr_err_ratelimited("PDU length(%u) excceed maximum allowed pdu size(%u) on connection(%d)\n",
					pdu_size, max_allowed_pdu_size,
					READ_ONCE(conn->status));
			break;
		}

		/*
		 * Check maximum pdu size(0x00FFFFFF).
		 */
		if (pdu_size > MAX_STREAM_PROT_LEN) {
			pr_info("pdu_size error, pdu_size: %u\n", pdu_size);
			break;
		}

		if (pdu_size < SMB1_MIN_SUPPORTED_HEADER_SIZE) {
			pr_info("pdu_size error, pdu_size: %u\n", pdu_size);
			break;
		}

		if (pdu_size == max_pdu_size) {
			time = ksmbd_get_sleep_time();
			if (time != 0)
				msleep(time);
		}

		if ((pdu_size != max_pdu_size) || pipe_flag) {
			/* 4 for rfc1002 length field */
			/* 1 for implied bcc[0] */
			size = pdu_size + 4 + 1;
			conn->request_buf = kvmalloc(size, GFP_KERNEL);
			if (!conn->request_buf) {
				pr_info("request_buf alloc failed\n");
				break;
			}

			memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));

			/* We already read 4 bytes to find out PDU size, now read in PDU */
			size = t->ops->read(t, conn->request_buf + 4, pdu_size, 2);
			if (size < 0) {
				pr_err("sock_read failed: %d\n", size);
				break;
			}

			if (size != pdu_size) {
				pr_err("PDU error1. Read: %d, Expected: %d\n",
					size, pdu_size);
				continue;
			}
		} else {
			size = t->ops->read(t, smb2_hdr_buf, 64, 2);  /* receive header */
			if (size != 64) {
				pr_err("sock_read smb2_hdr_buf failed: %d\n", size);
				break;
			}

			rcv_hdr2 = (struct smb2_hdr *)smb2_hdr_buf;
			if (rcv_hdr2->Command == SMB2_WRITE_HE) {
				g_total_request_cnt = ksmbd_get_conn_busy_cnt();
				if (g_total_request_cnt > max_worker_cnt) {
					ksmbd_debug(CONN, "***** total_request_cnt : %d\n",
						g_total_request_cnt);
					msleep(250);
				}
			}

			if ((rcv_hdr2->ProtocolId != SMB2_PROTO_NUMBER) ||
				(rcv_hdr2->Command != SMB2_WRITE_HE) ||
				((rcv_hdr2->Flags & SMB2_FLAGS_SIGNED) != 0)) {
				size = pdu_size + 4 + 1;
				conn->request_buf = kvmalloc(size, GFP_KERNEL);
				if (!conn->request_buf) {
					pr_info("request_buf alloc failed\n");
					break;
				}

				memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
				memcpy(conn->request_buf + 4, smb2_hdr_buf, 64);

				size = t->ops->read(t, conn->request_buf + 4 + 64,
					pdu_size - 64, 2);
				if (size < 0) {
					pr_err("sock_read failed: %d\n", size);
					break;
				}

				if (size != pdu_size - 64) {
					pr_err("PDU error2. Read: %d, Expected: %d\n",
						size, pdu_size);
					continue;
				}
			} else {
				size = t->ops->read(t, smb2_hdr_buf + 64, 48, 2);
				if (size != 48) {
					pr_err("sock_read 1 failed: %d\n", size);
					break;
				}

				req = (struct smb2_write_req *)smb2_hdr_buf;
				sess = ksmbd_session_lookup_all(conn, rcv_hdr2->SessionId);
				if (sess == NULL) {
					pr_err("sock_read session not found!\n");
					break;
				}

				if (ksmbd_is_fd_support_splice_write(sess,
					req->VolatileFileId, req->PersistentFileId)) {
					conn->request_buf = kvmalloc(128, GFP_KERNEL);
					if (!conn->request_buf)
						break;
					memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
					memcpy(conn->request_buf + 4, smb2_hdr_buf,
						sizeof(smb2_hdr_buf));

					error = ksmbd_create_pipe_files(files, O_RDWR);
					if (error) {
						pr_info("ksmbd_create_pipe_files failed %d\n",
							error);
						break;
					}

					filp_close(files[1], NULL);

					ipipe = ksmbd_get_pipe_info(files[0], true);
					if (ipipe == NULL) {
						fput(files[0]);
						pr_info("ksmbd_get_pipe_info failed\n");
						break;
					}

					(void)ksmbd_pipe_fcntl(files[0], F_SETPIPE_SZ, 4194304);

					size = t->ops->splice_read(t, ipipe, max_write_size);
					if (size != max_write_size) {
						fput(files[0]);
						pr_err("tcp_splice_read failed: %d\n", size);
						break;
					}

					conn->pipe_file = files[0];
				} else {
					size = pdu_size + 4 + 1;
					conn->request_buf = kvmalloc(size, GFP_KERNEL);
					if (!conn->request_buf) {
						pr_info("request_buf alloc failed\n");
						break;
					}

					memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
					memcpy(conn->request_buf + 4, smb2_hdr_buf, 112);

					size = t->ops->read(t, conn->request_buf + 4 + 112,
						pdu_size - 112, 2);
					if (size < 0) {
						pr_err("sock_read2 failed: %d\n", size);
						break;
					}

					if (size != pdu_size - 112) {
						pr_err("PDU error3. Read: %d, Expected: %d\n",
							size, pdu_size);
						continue;
					}
				}
			}
		}

		if (!ksmbd_smb_request(conn))
			break;

		if (((struct smb2_hdr *)smb2_get_msg(conn->request_buf))->ProtocolId ==
		    SMB2_PROTO_NUMBER) {
			if (pdu_size < SMB2_MIN_SUPPORTED_HEADER_SIZE)
				break;
		}

		if (!default_conn_ops.process_fn) {
			pr_err("No connection request callback\n");
			break;
		}

		if (default_conn_ops.process_fn(conn)) {
			pr_err("Cannot handle request\n");
			break;
		}
	}

out:
	ksmbd_conn_set_releasing(conn);
	/* Wait till all reference dropped to the Server object*/
	wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);

	if (IS_ENABLED(CONFIG_UNICODE))
		utf8_unload(conn->um);
	unload_nls(conn->local_nls);
	if (default_conn_ops.terminate_fn)
		default_conn_ops.terminate_fn(conn);
	t->ops->disconnect(t);
	module_put(THIS_MODULE);

	ffwd_tuple_accelerate(0, local_addr, peer_addr);
	return 0;
}

void ksmbd_conn_init_server_callbacks(struct ksmbd_conn_ops *ops)
{
	default_conn_ops.process_fn = ops->process_fn;
	default_conn_ops.terminate_fn = ops->terminate_fn;
}

int ksmbd_conn_transport_init(void)
{
	int ret;

	mutex_lock(&init_lock);
	ret = ksmbd_tcp_init();
	if (ret) {
		pr_err("Failed to init TCP subsystem: %d\n", ret);
		goto out;
	}

	ret = ksmbd_rdma_init();
	if (ret) {
		pr_err("Failed to init RDMA subsystem: %d\n", ret);
		goto out;
	}
out:
	mutex_unlock(&init_lock);
	return ret;
}

static void stop_sessions(void)
{
	struct ksmbd_conn *conn;
	struct ksmbd_transport *t;

again:
	down_read(&conn_list_lock);
	list_for_each_entry(conn, &conn_list, conns_list) {
		t = conn->transport;
		ksmbd_conn_set_exiting(conn);
		if (t->ops->shutdown) {
			up_read(&conn_list_lock);
			t->ops->shutdown(t);
			down_read(&conn_list_lock);
		}
	}
	up_read(&conn_list_lock);

	if (!list_empty(&conn_list)) {
		schedule_timeout_interruptible(HZ / 10); /* 100ms */
		goto again;
	}
}

void stop_sessions_with_name_ex(char *name)
{
	struct ksmbd_conn *conn;
	struct ksmbd_transport *t;

	down_read(&conn_list_lock);
	list_for_each_entry(conn, &conn_list, conns_list) {
		if (ksmbd_is_session_with_path(conn, name)) {
			t = conn->transport;
			ksmbd_conn_set_exiting(conn);
			if (t->ops->shutdown) {
				up_read(&conn_list_lock);
				t->ops->shutdown(t);
				down_read(&conn_list_lock);
			}
		};
	}
	up_read(&conn_list_lock);
}

bool session_contain(const char *name)
{
	struct ksmbd_conn *conn;

	down_read(&conn_list_lock);
	list_for_each_entry(conn, &conn_list, conns_list) {
		if (ksmbd_is_session_with_path(conn, (char *)name)) {
			up_read(&conn_list_lock);
			return true;
		};
	}

	up_read(&conn_list_lock);
	return false;
}

void stop_sessions_with_name(char *name)
{
	struct ksmbd_conn *conn;
	struct ksmbd_transport *t;
	int i = 0;

again:
	i++;
	down_read(&conn_list_lock);
	list_for_each_entry(conn, &conn_list, conns_list) {
		if (ksmbd_is_session_with_path(conn, name)) {
			t = conn->transport;
			ksmbd_conn_set_exiting(conn);
			if (t->ops->shutdown) {
				up_read(&conn_list_lock);
				t->ops->shutdown(t);
				down_read(&conn_list_lock);
			}
		};
	}
	up_read(&conn_list_lock);

	/* wait wait up to 10s */
	if (session_contain(name) && i < 100) {
		schedule_timeout_interruptible(HZ / 10); /* 100ms */
		ksmbd_debug(SMB, "wait 100ms %d\r\n", i);
		goto again;
	}
}

void ksmbd_conn_transport_destroy(void)
{
	mutex_lock(&init_lock);
	ksmbd_tcp_destroy();
	ksmbd_rdma_destroy();
	stop_sessions();
	mutex_unlock(&init_lock);
}
